Signed-off-by: NRémy Coutable <remy@rymai.me>

In Geo, Project#ensure_repository is used to make sure that a Git repo
is available to be fetched on a secondary. If a project were a fork,
this directory would never be created.

Closes gitlab-org/gitlab-ee#2800

This optimises how GroupProjectsFinder builds it collection, producing
simpler and faster queries in the process. It also cleans up the code a
bit to make it easier to understand.

Ran:
 - git format-patch v9.2.2..v9.2.5 --stdout > patchfile.patch
 - git checkout -b 9-2-5-security-patch origin/v9.2.2
 - git apply patchfile.patch
 - git commit
 - [Got the sha ref for the commit]
 - git checkout -b upstream-9-2-security master
 - git cherry-pick <SHA of the patchfile commit>
 - [Resolved conflicts]
 - git cherry-pick --continue

Ran:
 - git format-patch v9.2.2..v9.2.5 --stdout > patchfile.patch
 - git checkout -b 9-2-5-security-patch origin/v9.2.2
 - git apply patchfile.patch
 - git commit
 - [Got the sha ref for the commit]
 - git checkout -b upstream-9-2-security master
 - git cherry-pick <SHA of the patchfile commit>
 - [Resolved conflicts]
 - git cherry-pick --continue

Add a scope to search for the projects that are starred by a certain user.

This reverts commit c425f366, reversing
changes made to 82f6c0f5.
Signed-off-by: NRémy Coutable <remy@rymai.me>

Also introduce Ci::Variable#to_runner_variable to
build up the hash for runner.

Use the EnforcedStyleForMultiline: no_comma option.
Signed-off-by: NRémy Coutable <remy@rymai.me>

Signed-off-by: NRémy Coutable <remy@rymai.me>

So we can block `objects` only when it is contained in `info/lfs` or `gitlab-lfs`

`Project` uses `ProjectPathValidator` which is now a
`NamespaceValidator` that skips the format validation.

That way we're sure we are using the same collection of reserved
paths.

I updated the path constraints to reflect the changes: We now allow
some values that are only used on a top level namespace as a name for
a nested group/project.